CVE-2025-40602

SonicWall SMA1000 Missing Authorization Vulnerability

SonicWall — SMA1000 appliance

Added to KEV catalog: 17 December 2025
Federal remediation due date: 24 December 2025
Weakness classification (CWE): CWE-862, CWE-250

CISA Description

SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable

Notes

Check for signs of potential compromise on all internet accessible SonicWall SMA1000 instances after applying mitigations. For more information please see: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019 ; https://nvd.nist.gov/vuln/detail/CVE-2025-40602

View on NVD View on MITRE CVE View full CISA catalog

More SonicWall Vulnerabilities

CVE-2023-44221

SonicWall SMA100 Appliances OS Command Injection Vulnerability

CVE-2021-20035

SonicWall SMA100 Appliances OS Command Injection Vulnerability

CVE-2024-53704

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

CVE-2025-23006

SonicWall SMA1000 Appliances Deserialization Vulnerability

CVE-2024-40766

SonicWall SonicOS Improper Access Control Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services